CVE-2026-47508

A flaw was found in the NVIDIA GPU Display Driver. An issue in the kernel mode layer allows a local user to cause an incorrect conversion between numeric types. A successful exploit can allow an attacker to execute arbitrary code, escalate privileges, cause a denial of service (DoS), or disclose sensitive information.

This vulnerability is rated as Important because, although exploitation is restricted to authenticated local users with access to GPU device nodes, successful exploitation permits full kernel-level privilege escalation, arbitrary code execution, and system compromise. Red Hat Enterprise Linux systems are only exposed if the proprietary NVIDIA GPU display driver packages are deployed on systems equipped with compatible physical or pass-through NVIDIA hardware. Standard enterprise installations without NVIDIA graphics accelerators or deployments utilizing the open-source nouveau driver remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability on systems where NVIDIA GPU functionality is not required, prevent the driver module from autoloading:

1. Blacklist the kernel module:

echo "install nvidia /bin/false" > /etc/modprobe.d/blacklist-nvidia.conf

echo "blacklist nvidia" >> /etc/modprobe.d/blacklist-nvidia.conf

2. If the module is currently loaded, reboot the system to unload it:

systemctl reboot

Warning: A system reboot or service restart is required if the driver module is already loaded in the active kernel session.

Caveat: Applying this mitigation prevents the NVIDIA GPU driver from operating, which disables graphical desktop acceleration and GPU compute workloads.